ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A compensating control must offer protection that is comparable in intent and strength to the missing primary control. While host-based IPS analyzes traffic on the instance itself, deploying an inline, stateful network security service that applies intrusion-prevention rules to all traffic entering and leaving the subnet provides similar detection and blocking capability. AWS Network Firewall can inspect traffic against managed rule groups and block known exploits, thereby mitigating many of the threats the HIPS would address. The other options either reduce the attack surface or improve logging but do not actively detect and block malicious traffic, so they do not provide equivalent protection.